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Preface 



The Department of Homeland Security Office of Inspector General was established by 
the Homeland Security Act of 2002 (Public Law 1 07-296) by amendment to the Inspector 
General Act of 1978. This is one of a series of audit, inspection, and special reports 
prepared as part of our oversight responsibilities to promote economy, efficiency, and 
effectiveness within the department. 

This report addresses the strengths and weaknesses of the REAL ID program. It is based 
on interviews with employees and officials of relevant agencies and institutions, direct 
observations, and a review of applicable documents. 

The recommendations herein have been developed to the best knowledge available to our 
office, and have been discussed in draft with those responsible for implementation. We 
trust this report will result in more effective, efficient, and economical operations. We 
express our appreciation to all who contributed to the preparation of this report. 




Richard L. Skinner 
Inspector General 
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OIG 



Department of Homeland Security 
Office of Inspector General 

Executive Summary 

In 2005, Congress passed the REAL ID Act to strengthen the 
security of state-issued driver's licenses and identification cards in 
response to the use of fraudulent identification documents by the 
September 11, 2001, terrorists. The Act set minimum standards 
for identification documents accepted by federal agencies for 
official purposes such as entering federal buildings, visiting 
nuclear facilities, and boarding airplanes. The Department of 
Homeland Security (DHS) was tasked with implementing the Act 
and assisting states with becoming REAL ID compliant. We 
reviewed DHS' REAL ID program to assess the financial impact 
on 19 states' ability to comply with the law and determine whether 
grants sufficiently mitigated costs. 

Potentially high costs pose a significant challenge to states in their 
efforts to implement REAL ID. Specifically, state officials 
considered REAL ID implementation costs prohibitive because of 
requirements such as the reenrollment of all current driver' s 
license and identification card holders and the new verification 
processes. Further, state officials in 17 of the 19 states we 
contacted indicated they needed more timely guidance from DHS 
to estimate the full cost of implementing REAL ID. State officials 
also said that REAL ID grants did not sufficiently mitigate the 
costs, and they viewed communication of grant information by 
DHS as ineffective. 

We recommend that the Assistant Secretary for Policy: 

• Ensure stakeholders consisting of federal, state, and 
private representatives help develop and disseminate 
necessary guidance related to the REAL ID card 
marker, facility security, verification systems, and best 
practices that would assist stakeholders in 
implementing REAL ID. 

• Establish a communications plan to ensure that 
stakeholders receive the necessary REAL ID program 
and grant guidance. 
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Background 



Following the terrorist attacks on September 11, 2001, Congress 
and the President established the 9/11 Commission to determine 
how the events transpired and how the United States could prevent 
future occurrences. 1 The Commission reported that the terrorists 
used false identification documents. The hijackers had 30 state- 
issued forms of identification; and at least seven of these 
documents were obtained fraudulently. These identification 
documents were used to rent cars and apartments, open bank 
accounts, and board planes. 

In its report, the Commission recommended that the federal 
government set standards for the issuance of birth certificates and 
sources of identification such as driver's licenses. The 
Commission noted that identification document fraud is no longer 
a problem of mere theft. Further, at many entry points to 
vulnerable facilities, including gates for boarding aircraft, sources 
of identification are the last opportunity to ensure that people are 
who they say they are and to screen for terrorists. 

On May 11, 2005, the President signed the REAL ID Act of 2005. 3 
The REAL ID Act (hereafter referred to as "the Act") was intended 
to improve security for driver' s licenses and state identification 
cards, thereby making it more difficult for individuals to obtain 
false identification documents. The Act states that, beginning 3 
years after the date of its enactment, on May 11, 2008, a federal 
agency may not accept, for any official purpose, a driver's license 
or identification card issued by a state unless the state meets the 
Act's requirements. Official purposes include activities such as 
accessing federal facilities, entering nuclear power plants, and 
boarding federally regulated commercial aircraft. 

The Act established specific minimum requirements that states 
must include on driver's licenses and identification cards for them 
to be accepted for official purposes. 4 Specifically, the driver's 
licenses and identification cards must include the individual's full 
legal name, date of birth, driver' s license or identification card 
number, gender, address of principal residence, and signature, as 
well as a digital photograph. The driver's licenses and 
identification cards also must have physical security features 

1 The National Commission on Terrorist Attacks Upon the United States, Public Law 107-306, November 
27, 2002. 

2 Final Report of the National Commission on Terrorist Attacks Upon the United States, July 22, 2004. 

3 Public Law 109-13, Division B, REAL ID Act of 2005, Section 202, May 11, 2005. 

4 The requirements of the Act only apply to those states that choose to comply. 
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designed to prevent tampering, counterfeiting, and duplication, as 
well as a machine-readable technology with defined minimum 
elements. 

The Act requires states to adopt minimum standards when issuing 
driver's licenses and identification cards that are acceptable for 
official purposes such as entering federal buildings, visiting 
nuclear facilities, and boarding airplanes. For example, states must 
require that license and card applicants present certain 
documentation, including documents showing name, date of birth, 
proof of Social Security number, address of principal residence, 
and that the applicant is lawfully present in the United States. 

States must establish procedures to verify that the documents are 
authentic and not forged or fraudulent. For example, states must 
verify the lawful status of an applicant through the Systematic 
Alien Verification for Entitlements (SAVE) system, and confirm 
the validity of social security numbers with the Social Security 
Administration. In addition to verifying the authenticity of source 
documents, states must also confirm that individuals are not 
holders of a separate REAL ID license in another state. 

The Act further requires states to ensure the physical security of 
facilities where driver's licenses and identification cards are 
produced, as well as the security of the material used to produce 
them. 

Individuals who meet the requirements of the Act will receive a 
REAL ID-compliant driver's license or identification card. 
Individuals who do not satisfy the requirements can still receive a 
state-issued identification card; however, it will not be acceptable 
to federal agencies for official purposes. The noncompliant 
identification card must be clearly marked to alert federal agencies 
that it cannot be used for official purposes. 

The requirements for implementation of the Act pose substantial 
economic implications for each of the 56 jurisdictions 5 of the 
United States, which together have more than 240 million 
applicants for and holders of a state driver' s license or 
identification card. In recognition of the economic implications, 
between 2005 and 2008, Congress made approximately $90 
million available in grant funding for REAL ID implementation. 



5 Jurisdictions are defined as all 50 states, territories of the United States, and the District of Columbia, and 
will hereafter be referred to as "states" within this report. 
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DHS' Role in Implementing the REAL ID Act of 2005 



The Act authorizes DHS, in consultation with the states and the 
Department of Transportation, to issue regulations and set 
standards to implement the requirements of the Act. Additionally, 
DHS is responsible for determining whether a state is meeting the 
requirements of the Act based on state certifications to the 
Secretary. DHS is also authorized to issue grants to states to assist 
them in conforming to the Act's standards. 

After the passage of the Act in 2005, DHS conducted a series of 
REAL ID working group meetings with DHS components and 
other government agencies. 6 In late 2006, DHS established the 
REAL ID Program Office within the Office of Policy's Screening 
Coordination Office to manage the implementation of the Act. 
The Federal Emergency Management Agency's Grants Program 
Directorate (FEMA GPD) works with the REAL ID Program 
Office to administer grants to states to assist with REAL ID 
implementation costs. Figure 1 provides a depiction of DHS 
REAL ID components. 

DHS REAL ID Program Components 

DHS Secretary 



Office of Policy 
Assistant Secretary 




FEMAAdministrator 












Screening 
Coordination Office 




Assistant 
Administrator 
Grant Programs 












Real ID Program Office 


4 ». 


FEMA 
Grant Programs 
Directorate 



(Grant Administrator for REAL ID) 
Figure 1: DHS REAL ID Program Components 

The mission of the REAL ID Program Office is the timely, cost- 
effective, and successful implementation of the Act. It established 
the following objectives to meet that mission: 



6 The REAL ID working group meetings were attended by various DHS component officials and 
representatives from other government agencies such as the Department of Transportation, Department of 
State, Department of Justice, Social Security Administration, and the Department of Health and Human 
Services. 
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• Facilitate the process to implement the requirements of the Act; 

• Evaluate implementation solutions to reduce costs and help 
states expedite compliance with the Act; 

• Issue guidelines for state submission of certifications of 
compliance; 

• Assist states in completing certifications, monitor state 
progress toward compliance, and conduct audits of state 
compliance; and 

• Support initiatives related to REAL ID implementation, such as 
technology and business process upgrades, through grants. 

FEMA GPD is responsible for administering the REAL ID grant 
process, including soliciting awards, and developing guidance for 
state submissions of grant applications. 

REAL ID National Impact Analysis 

To determine the fiscal and operational impact of the Act, in 2006, 
the American Association of Motor Vehicle Administrators 
(AAMVA), in conjunction with the National Governors 
Association and the National Conference of State Legislators, 
conducted a nationwide survey of state motor vehicle agencies 
(DMV). The results of this survey indicated that implementation 
of the Act would cost states more than $11 billion over five years. 7 
The report identified reenrollment, new verification processes, and 
card design requirements as the three most costly requirements. 

Reenrollment 

AAMVA cost estimates indicated that states would spend $8.48 
billion over five years to reenroll all 245 million driver' s license 
and identification card holders in the United States. States 
anticipated that they would need to hire additional employees; 
increase service hours; expand facilities; purchase additional 
equipment; implement public education campaigns; and handle 
increased calls, complaints, and return visits. 

New Verification Processes 

Verifying the validity of an applicant's identification documents 
with the appropriate issuing agency, storing verification 
information, capturing images of all applicants, and other related 
processes would cost states an estimated $1.42 billion over five 



7 The Real ID Act: National Impact Analysis, September 2006, Presented by the National Governors 
Association, the National Conference of State Legislatures, and the American Association of Motor 
Vehicle Administrators. This survey will hereafter be referred to as developed by AAMVA. 
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years. Compliance with the Act requires states to independently 
verify each identification document with its issuing agency through 
the use of five national electronic systems to facilitate verification. 
These systems will provide for data verification and state-to-state 
data exchanges to validate Social Security numbers, establish 
lawful status of REAL ID card applicants, and ensure that an 
applicant does not hold another REAL ID card or driver's license 
in another state. States would need to adapt their systems for the 
new requirements and establish connections with verification 
systems once they are made available. These estimates did not 
include transaction fees that may be required for states to access 
the verification systems. 

Card Design Requirements 

Assuming that a uniform security configuration would be 
prescribed, states estimated that they would spend $1.1 billion over 
a five-year period to incorporate security features into driver's 
licenses and identification cards to prevent tampering, 
counterfeiting, or duplication. 

DHS Notice of Proposed Rulemaking 

On March 3, 2007, DHS published its proposed requirements to 
meet the minimum standards of the Act in a Notice of Proposed 
Rulemaking (Proposed Rule). The Proposed Rule included 
requirements for applicant documentation, documentation 
verification, the information to be included on driver's licenses and 
identification cards, security features on the cards, facility security 
plans, DMV employee background checks, the state certification 
process, and database connectivity. 

Under the Proposed Rule, as of May 11, 2008, federal agencies 
could not accept driver's licenses or identification cards for official 
purposes from individuals in states that were not REAL ID 
compliant. States that intended to comply with REAL ID would 
have a five-year period, or until May 1 1, 2013, to replace all 
existing driver's licenses and identification cards if those 
documents were to be used for official purposes. 

The Proposed Rule allowed states to request a one-year extension 
of the compliance date from DHS. Extension requests were to be 
submitted no later than March 31, 2008, and the extension would 
terminate December 31, 2009. DHS received more than 21,000 
comments from stakeholders, including state and local DMV 
representatives along with private industry organizations. 
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Stakeholders expressed concern that the costs of the REAL ID 
program would be "huge," "exorbitant," "significant," or 
"excessive." 

The Final Rule: DHS' Efforts to Reduce State Costs 

The Final Rule, published by DHS on January 29, 2008, included 
several major changes to address the concerns raised in the 
comments to the Proposed Rule, as well as in the AAMVA 
National Impact Analysis. Specifically, DHS extended 
reenrollment periods, provided an additional extension of the 
compliance deadline to address concerns relating to the new 
verification processes, and relaxed card design requirements. 

Extended Reenrollment Periods 

To reduce the operational burden on states, the Final Rule 
instituted a two-phased reenrollment schedule based on age. States 
will have until December 1, 2014, to reenroll individuals born after 
December 1, 1964. States will have an additional three years, until 
December 1, 2017, to reenroll individuals born on or before 
December 1, 1964. In addition, states will be allowed to reissue a 
driver's license or identification card without requiring an in 
person visit, if there has not been a significant change in the 
applicant's information since the prior issuance. 

Extended Compliance Deadlines 

In response to state comments that the lack of a centralized 
verification system would make it impossible to comply with 
statutory requirements by December 31, 2009, the date the first 
extension terminates, the Final Rule allows states to obtain a 
second extension to May 1 1, 201 1 . Figure 2 shows the extended 
deadlines imposed by the Final Rule. 
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STATE COMPLIANCE MILESTONES AND DEADLINES 
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Figure 2: REAL ID Extended Compliance Milestones and Deadlines 



Only states that demonstrate they have achieved "material 

o 

compliance" with the Act will be granted the additional extension. 
DHS developed a checklist containing 18 milestones that are 
mandatory requirements under the Act, and must be met to achieve 
material compliance. These milestones are listed in Figure 3. 



Material compliance is an interim status that certifies a state is taking measurable steps toward becoming 
REAL ID compliant. This status differs from full compliance in that states cannot issue REAL ID 
compliant licenses until they have been certified by DHS as having achieved full compliance. 
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Material Compliance Checklist 


1 . Subject each applicant to a mandatory facial image 
capture and retain such image even if a driver 
license (DL) or identification card (ID) is not issued. 

2. Have each applicant sign a declaration under penalty 
of perjury that the information presented is true and 
correct, and the State must retain this declaration. 

3. Require an individual to present at least one of the 
source documents listed in subsections (i) through 
(x) when establishing identity. 

4. Require documentation of: Date of birth; Social 
Security Number; Address of principal residence; 
Evidence of lawful status. 

5. Have a documented exceptions process that meets 
the requirements established in§37.11(h)(1)-(3)(lf 
States choose to have such a process). 

6. Make reasonable efforts to ensure that the applicant 
does not have more than one DL or ID already 
issued by that State under a different identity. 

7. Verify lawful status through SAVE or another method 
approved by DHS. 

8. Verify Social Security account numbers with the 
Social Security Administration or another method 
approved by DHS. 

9. Issue DL and IDs that contain Level 1 , 2 and 3 
integrated security features. 


10. Surface of cards include the following printed 
information in Latin alpha-numeric characters: Full 
legal name; Date of birth; Gender; Unique DL/ID 
number; Full facial digital photograph; Address of 
principal residence [with exceptions]; Signature 
[with exceptions]; Date of transaction. 

1 1 . Commit to marking fully compliant DL and IDs with 
a DHS-approved security marking. 

12. Issue temporary or limited-term licenses to all 
individuals with temporary lawful status and tie 
license validity to the end of lawful status. 

13. Have a documented security plan for DMV 
operations in accordance with the requirements 
set forth in §37.41. 

14. Have protections in place to ensure the security of 
personally identifiable information. 

15. Require all employees handling source 
documents or issuing DL or IDs to attend and 
complete the AAMVA approved (or equivalent) 
fraudulent document recognition training and 
security awareness training. 

16. Conduct name-based and fingerprint-based 
criminal history and employment eligibility checks 
on employees in covered positions or an 
alternative procedure approved by DHS. 

17. Commit to be in full compliance with Subparts A 
through D on or before May 11, 201 1 . 

18. Clearly state on the face of non-compliant DLs or 
IDs that the card is not acceptable for official 
purposes, except for licenses renewed or reissued 
under § 37.27. 



Figure 3: Material Compliance Checklist for States 



States must certify to DHS that they have met these milestones to 
obtain the extension. The extension expires on May 1 1, 201 1, at 
which time states must begin issuing fully compliant REAL ID 
driver's licenses and identification cards. 

Relaxed Card Design Requirements 

In response to comments that the physical security features for 
licenses and identification cards were an undue burden on states, 
DHS removed the proposed card standards. Under the Final Rule, 
states must conduct a review of their respective card designs and 
submit a report to DHS as part of its certification package that 
indicates the ability of the designs to resist compromise and 
document fraud attempts. 

Driver's licenses and identification cards that are not compliant 
with REAL ID must clearly state that they will not be accepted by 
any federal agency for identification or any other official purpose. 
The Final Rule leaves the types of marking and unique coloring to 
the states' discretion, subject to DHS' approval. The Final Rule 
requires that REAL ID-compliant driver's licenses and 
identification cards bear a DHS-approved security marking. 

According to DHS, these and other changes to the proposed 
requirements significantly reduced the states' costs to implement 
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the Act. Figure 4 provides the main cost concerns identified in the 
AAMVA National Impact Analysis and the Final Rule's effect on 
those cost concerns. 



Major Cost Concerns and 
Effect of the Final Rule 



New Verification Process 



Changed to.. 



Extend Reenrollment Periods 













Changed to... 




Extend Compliance Deadlines 



DL/ID Design 




Changed to.. 



Give States More Flexibility 



Figure 4: Final Rule's Effect on Major Cost Concerns 



In January 2008, DHS conducted a Regulatory Evaluation of 
REAL ID to weigh the costs and benefits of the Act. The results of 
the evaluation indicated that the changes in the standards had 
reduced the costs to states by 73%. 
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Results of Audit 



States Reported REAL ID Implementation Remains Cost Prohibitive 

Although the Final Rule reduced expected state costs for 
complying with the Act, states continue to consider the costs 
prohibitive. In addition, DHS did not provide timely guidance or 
information on implementing several potentially costly 
requirements because it did not apply an effective communication 
strategy for developing and disseminating guidance to 
stakeholders. As a result, states could not accurately estimate the 
full costs of implementing REAL ID. 

States Surveyed Were Concerned About Cost 

Officials in several states told us that changes in the requirements 
from the Proposed Rule to the Final Rule had, in fact, reduced their 
expected costs for complying with the Act. For example, one state 
estimated it would cost $185 million to implement the 
requirements under the Proposed Rule; estimated costs under the 
Final Rule are between $65 million to $80 million. Another state's 
estimated costs dropped from $97 million to $47 million. 

Despite the reduction in estimated costs, states continue to consider 
the overall cost of implementing REAL ID requirements 
prohibitive. Specifically, 13 of the 19 states we surveyed indicated 
that implementing REAL ID would be cost prohibitive. Five states 
were uncertain or unable to accurately estimate their costs. Only 
one of 19 states surveyed indicated that the cost of REAL ID 
would not be prohibitive because it had already taken measures to 
improve driver's license security that positioned it to meet the 
requirements of the Act. These results are illustrated in Figure 5. 

Is REAL ID Cost Prohibitive for Your State? 




Figure 5: State Responses to REAL ID Costs 
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Officials from many of the states surveyed told us that reenrolling 
all driver's license and identification card holders, and 
implementing the required verification processes, would be 
particularly costly. 

Reenrollment 

Several states reported that the costs associated with reenrolling 
current driver' s license and identification card holders remain a 
concern. Specifically, the reenrollment of residents will increase 
the number of DMV customers and the time it takes to provide 
service to them. For example, one state anticipates that as many as 
100,000 residents will visit its DMVs per day, which will require 
about 3,000 DMV employees. A DMV in another state already 
serves 1,200 customers each day. The state believes that REAL ID 
will require a substantial increase in the amount of time to serve 
each customer, which will lead to increased waiting times. 
Another state expressed concern that current card holders and new 
applicants would bring the wrong documents with them, causing 
applicants to make return visits. 

Many DMVs in the states we surveyed are ill-equipped to handle 
the expected surge. To accommodate increased customers, and the 
new business processes, DMV officials said they would need to 
hire and train more employees. State officials also said they might 
need to upgrade or expand existing DMV facilities. These 
reenrollment challenges are expected to be particularly 
burdensome for over-the-counter issuance states, which have a 
large number of small facilities that issue driver's licenses and 
identification cards. 

Officials in one state said the cost of reenrollment was especially 
challenging because it had already established processes consistent 
with REAL ID requirements. Although this state's DMV is nearly 
90% compliant with REAL ID requirements, DHS has stated that 
no state could be materially compliant prior to the enactment of the 
Act. Therefore, even though current license and card holders 
presented original source documents at the time of application and 
those documents were verified, the documents must be recertified 
under the Act. This redundancy accounts for most of this state's 
$150 million cost estimate for REAL ID compliance. 

Verification Processes 

States also remain concerned about the costs associated with the 
new verification processes. For example, the requirement to take a 
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digital photo at the beginning of the license application process 
will require additional equipment and facility upgrades to counter 
space. Also, one state official said that its current system captures 
only 25 characters for applicant names. As a result, this state 
needs to upgrade its system to capture around 125 characters for an 
applicant's full legal name. 9 

In addition, states are concerned about the fees for using the 
systems required to verify applicants' information. For example, 
the cost for using one existing system, SAVE, was increased 
recently. One state had been paying 5 cents for each transaction to 
verify the lawful status of applicants through the SAVE system. 
DHS sent a letter in July 2008 notifying this state that the fee had 
been increased to 50 cents per transaction. The state received the 
notification after the end of its legislative session, making it too 
late to request funds to cover the cost increase. 

REAL ID Guidance to States Not Timely 

The Final Rule states that DHS will work to develop best practices 
to guide future verification system design, development and 
operation, as well as privacy and security best practices, including 
security plans for DMV facilities. One of the primary objectives of 
the REAL ID Program Office is to work closely with states to 
facilitate compliance with REAL ID requirements by issuing 
guidelines or best practices. 

Officials from several states reported that the REAL ID Program 
Office has communicated effectively with states in general, and 
that communication has improved over time. For example, DHS 
attended at least four AAMVA regional conferences during which 
it provided information on the REAL ID program. However, states 
reported that they have not received sufficient or timely guidance 
for critical compliance requirements, which may result in 
significant costs to their states. Although many of the 
requirements that impact the cost to states were defined or 
addressed in the Final Rule, DHS did not provide timely and 
specific guidance on how REAL ID-compliant driver's licenses 
and identification cards must be marked, best practices for the 
physical security of facilities, or information on the systems that 
will be used for verifying applicant documentation. 



9 The 125 character storage capacity is an AAMVA standard endorsed by DHS, not a DHS requirement. 
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Card Marker 



To achieve material compliance by December 31, 2009, states are 
required to mark REAL ID-compliant licenses with the official 
marker approved by DHS. The details of the marker will affect the 
amount that states pay the card vendors who produce the licenses. 
Small changes can have a large impact for states with large driver 
populations. For example, one state said that an increase of 25 
cents per card for the marker would cost $7 million. 

Consequently, states needed to know what the marker would be to 
request sufficient funds in their DMV budgets. Officials from 
some states said that they could not wait much longer, or would 
have to move ahead with card design before DHS reached a final 
decision to meet the material compliance deadline. If this 
occurred, making the necessary changes later would lead to 
additional costs. 

In February 2008, DHS announced at an AAMVA briefing that a 
final determination on the marker would be released to states by 
mid March 2008. However, as of September 2008, officials from 
the states we interviewed had not received this guidance. 

Facility Security 

DHS did not provide states with timely guidance on physical 
security standards. The Final Rule requires that states provide a 
physical security plan to DHS for approval. States were concerned 
that if their proposals were not in line with DHS expectations, it 
would be too late to make the necessary changes before the 
material compliance deadline. States requested guidance from 
DHS to ensure their physical security plans would meet DHS 
expectations. At an AAMVA briefing in February 2008, DHS 
indicated that guidance would be forthcoming in three to six 
months. However, representatives from the states we surveyed 
said that they have yet to receive this guidance. 

Verification Systems 

DMV officials from several of the states we surveyed reported that 
they have not received sufficient information on the verification 
systems to understand the associated costs. To achieve full 
compliance with REAL ID standards by 2011, states must connect 
with electronic verification systems to verify identification 
documents. Several of the systems needed do not yet exist. Figure 
6 shows the verification systems that currently exist that states 
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must start using to achieve material compliance, as well as the 
systems required for full compliance that do not yet exist. 



Verification Item 



Systems 




Social Security 
Number 



SSOLV 

Social Security Online 
Verification System 



Lawful Resident 
Status 



SAVE 

Systematic Alien 
Verification for 
Entitlements 




Birth Certificate 
[System being piloted) 



EWE 

Electronic Verification 
of Vital Events 



Query Other States 
for Existing REAL ID 

(System does not exist) 



-J 



Driver System 

System yet to be 
named 



Verify US Passport 
(System does not exist) 



Passport 
Verification 



Figure 6: Verification Systems Requirements 



DHS has initiated a verification systems design project to define 
requirements for a "hub-based" network and messaging systems to 
support the requirements of REAL ID. States are concerned that 
the costs of upgrading their systems to connect and verify 
information with these systems will be high. States are also 
concerned that there may be high transaction costs to use the new 
verification systems. One state expects that these fees will add $4 
to $5 to the cost of each license. This would cost this state, which 
has about 4.6 million drivers, as much as $23 million in addition to 
what it plans to spend on REAL ID implementation. 

In February 2008, DHS had indicated to REAL ID stakeholders 
that verification transaction cost information would be 
forthcoming. Although development costs vary by state, DHS has 
been working with AAMVA and the Verification System Working 
Group to provide detailed information on ongoing costs for system 
access. 10 However, as of September 2008, officials from many of 
the states we contacted had not yet received this guidance. 



The Verification System Working Group, consisting of 14 states, was established in early 2006 to 
develop recommendations for the REAL ID verification system. 
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REAL ID Stakeholder Participation 



Although DHS developed an implementation plan for the REAL 
ID program, the plan did not include a strategy for developing and 
disseminating timely guidance and best practices to stakeholders. 
REAL ID program officials suggested an approach to providing 
timely guidance to stakeholders during an AAMVA conference. 
Specifically, the program officials discussed the possibility of 
creating a steering group made up of experienced DMV 
representatives. This group would field ideas from stakeholders to 
help develop necessary guidance to assist states in implementing 
REAL ID. 

Without the necessary guidance from DHS, states cannot develop 
cost estimates to accurately assess REAL ID implementation costs 
or take the steps to budget for the necessary funding. Owing to the 
lack of guidance on these requirements alone, officials in 17 of the 
19 states we contacted stated that they cannot estimate the full 
costs of REAL ID compliance. 

States Reported That Grants Are Insufficient to Mitigate REAL ID 
Implementation Costs 

States reported that grants for REAL ID were insufficient to 
mitigate costs associated with compliance. Also, states reported 
confusion about the grant application and award process. This 
occurred because DHS had not developed an effective strategy to 
communicate timely grant program guidance and decisions. 

REAL ID Funding 

Nearly all of the states surveyed reported that grants for REAL ID 
were inadequate to mitigate implementation costs. Specifically, 18 
of 19 states, or 95%, reported that available grant funding was 
insufficient. Several states referred to the amount received as a 
"drop in the bucket." Figure 7 highlights the disparity between the 
amounts requested and the amounts awarded to the states we 
contacted. 
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Figure 7: REAL ID Grants Awarded Compared to Grants Requested 



The average amount of grant funding requested for the 19 states 
was $8.5 million, while the average amount actually awarded was 
$1.7 million, less than 25% of what states said they needed to fund 
REAL ID. For example, one state requested $12.2 million and 
received approximately $550,000. 

States have requested that Congress make additional grant money 
available. Further, several state representatives have testified 
before Congress asking for increases in funding levels. As late as 
March 2008, stakeholders requested that the Administration and 
Congress provide at least an additional $1 billion in fiscal year 
(FY) 2008 in addition to the grants already awarded to states to 
assist with start-up costs. However, no additional FY 2008 funds 
were allocated in response to this request. 

Communication of Grant Information to Stakeholders 



FEMA GPD is responsible for developing guidance for state 
submissions of grant applications along with developing and 
communicating the application review process. However, 
representatives from 17 of the 19 states we contacted indicated that 
they did not receive clear guidance on the REAL ID grant process. 
Specifically, states reported that DHS did not clearly communicate 
the process and requirements for submitting grant applications, the 
process and criteria for grant awards, and the terms and 
stipulations for acceptance of the awards. 
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Grant Application Process 



FEMA GPD issued guidance on the REAL ID grant program to 
states in December 2007. 11 The guidance indicated that available 
grant funds would be awarded for electronic verification systems 
infrastructure development and proposals that would have 
multistate benefits such as the REAL ID Pilot Project and the 
REAL ID Vital Events Verification State Project. 

However, DHS decided in March 2008 to adjust the basis for 
award allocation to include the number of drivers per state, which 
resulted in a broader distribution of grant funds. DHS also 
extended the grant application deadline one month, to April 2008, 
to allow states more time to complete their grant applications. 
Officials from several states told us that when the award emphasis 
shifted, they were advised to submit an application to ensure 
inclusion. States that had not intended to apply for grants based on 
initial guidance had to scramble to submit an application by the 
deadline. Additionally, states that had spent time completing an 
application according to the initial guidance were frustrated by the 
shift in award criteria. 

Unclear about the requirements, states reported that their grant 
submissions were incomplete and misdirected. Specifically, 
officials from one state said that their grant submission only 
accounted for a portion of their total estimated implementation 
costs. These state officials explained that they received guidance 
from DHS suggesting that they scale back funding requests to 
improve their chances of receiving a grant award. 

Grant Award Process 

The grant guidance stated that proposals would be reviewed and 
assessed by a FEMA peer review panel based on the strength of the 
submission and would be awarded on a competitive basis. The 
panel evaluated applications and assigned a numeric score based 
on criteria such as innovation, security and privacy enhancements, 
and the state's likelihood for REAL ID implementation success 
and compliance. After scoring, rating, and ranking each 
application, the panel submitted its recommendations for grant 
funding to the FEMA GPD. 

However, the grants awarded in FY 2008 did not correspond to the 
panel rankings. For example, one relatively large state included in 



11 FY 2008 REAL ID Demonstration Grant Program: Program Guidance and Application Kit, December 
2007. 
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this review received a low ranking from the FEMA panel; 
however, the state received a large grant. Another state applied 
late and was not ranked by the FEMA panel; nevertheless, this 
state received grant funds. 

DHS decided in March 2008 to distribute grant funds more broadly 
than it originally planned. In June 2008, DHS awarded each of the 
48 states that applied a portion of the nearly $80 million available. 
The awards were based on a number of factors including the 
number of drivers in a state. Additionally, $17 million was 
allocated for a state to lead the verification hub project, and $4.8 
million was allocated between each of four states participating in 
the verification hub pilots. 

Terms of Grant Awards 

States reported that they were unclear if accepting grant funding 
obligated the state to comply with REAL ID. One state, that did 
not intend to implement REAL ID, reported it did not apply for 
grant funding as it otherwise would have because it received 
unclear guidance suggesting that application and acceptance of 
grant funding would require the state to comply with REAL ID. 
States reported that they received contradictory information from 
the REAL ID Program Office and FEMA GPD in this regard. 

Although DHS provided initial guidance on the grant program, it 
did not communicate timely to states the changes in the grant 
award criteria because it had not developed a communication 
strategy. Consequently, states did not fully understand the process 
and expressed their concern and dissatisfaction with DHS' 
communication concerning the grant process. 

Legislative Challenges Hinder State Efforts to Fund REAL ID 

Without sufficient grant funds, states must find ways to pay for 
REAL ID. Many states reported that funding significant new costs 
for REAL ID in a time when state budgets are shrinking poses an 
additional challenge for implementing REAL ID. Officials at one 
state DMV said that it was difficult to ask the state legislature for a 
large budget to fund REAL ID under these circumstances. 
Another state anticipated having to reallocate money from other 
critical needs. For example, one state raised the possibility of 
taking $100 million out of its highway fund as a last resort to cover 
the REAL ID implementation costs. 
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Some states are considering passing part of the cost to drivers 
through license fees. For example, one state said it anticipates 
increasing its driver's license fee to $50. Another state said that it 
would have to increase the cost of a driver's license from $30 to 
$100 to cover REAL ID costs. In some states driver's license fees 
are established by the legislature, making it difficult for those 
states to cover increased costs this way. 

States May Not Meet Material Compliance Deadline 

Because of the potential high cost to implement REAL ID and 
insufficient grants to cover those costs, many states are unsure if 
they will meet the material compliance requirements by December 
31, 2009. If they do not, they will not be eligible to obtain the 
extension provided in the Final Rule for full compliance. 

We asked state officials specifically whether their states would 
achieve material compliance benchmarks by the deadline. As 
illustrated in Figure 8, of the 19 states interviewed, only six states 
expected to meet the deadline, 10 states were not sure, and three 
states did not expect to be materially compliant by December 31, 
2009. 

Will Your State Meet REAL ID Material Compliance? 




Unknown 



Figure 8: State Responses to REAL ID Material Compliance 

Although cost is not the only factor influencing states' decisions on 
REAL ID, it is a major concern. Several states were hesitant to 
speculate on whether they would achieve material compliance until 
state executives and legislators reached a policy decision on REAL 
ID compliance. As indicated in Figure 9, some states introduced 
legislation opposing REAL ID based, in part, on concerns about 

Potentially High Costs and Insufficient Grant Funds Pose a Challenge to REAL ID Implementation 

Page 20 



the costs of what they view is an unfunded mandate. Some states 
have already enacted laws prohibiting REAL ID implementation. 

State Legislative Action on REAL ID 




No Legislation Opposing REAL ID 
Legislation Introduced Opposing REAL ID 
Legislation Passed Opposing REAL ID 

Figure 9: State REAL ID Legislative Actions 

Of our sample of 19 states, 11 introduced legislation and four 
enacted laws opposing compliance with REAL ID. 

Recommendations : 

We recommend that the Assistant Secretary for Policy: 

Recommendation #1 : Ensure stakeholders consisting of federal, 
state, and private representatives help develop and disseminate 
necessary guidance related to the REAL ID card marker, facility 
security, verification systems, and best practices that would assist 
stakeholders in implementing REAL ID. 

Recommendation #2 : Establish a communications plan to ensure 
that stakeholders receive the necessary REAL ID program and 
grant guidance. 
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Management Comments and OIG Analysis 

We obtained written comments on a draft of this report from the 
Acting Assistant Secretary for Policy. We have included a copy of 
the comments in their entirety in Appendix B. 

The Acting Assistant Secretary for Policy concurred with our 
recommendations and provided comments and context on specific 
areas within the report. Additionally, the Acting Assistant 
Secretary provided details on steps being taken to address specific 
findings and recommendations in the report. We have reviewed 
management's comments and provided an evaluation of the issues 
outlined in the comments below. 

In response to recommendation one, the Acting Assistant Secretary 
agreed that the REAL ID Program Office should ensure 
stakeholder participation to help develop and disseminate 
necessary guidance related to the REAL ID card marker, facility 
security, verification systems, and best practices that would assist 
stakeholders in implementing REAL ID. Accordingly, the REAL 
ID Program Office has undertaken initiatives and outreach 
activities in each of these areas. Specifically, DHS has convened a 
stakeholder group to provide input into the design and creation of 
the compliant card marking, and issued the final REAL ID 
Compliance Marking in January 2009, several months after 
completion of our audit field work. In addition, DHS has taken 
steps to include stakeholders in reviewing drafts and providing 
feedback on guidelines on physical and date security. Finally, the 
Acting Assistant Secretary identified the states as responsible for 
ensuring appropriate stakeholder participation for verification hub 
guidance. We believe that such efforts are good steps toward 
addressing our recommendation and look forward to learning more 
about continued progress and improvements in the future. 

Responding to recommendation two, the Acting Assistant 
Secretary stated that a joint effort with FEMA/GPD is underway to 
develop a communications plan. In addition, the Acting Assistant 
Secretary identified several steps under way to ensure outreach for 
FY09 grants. These steps include developing a memorandum of 
understanding to delineate FEMA GPD and Office of 
Policy/Screening Coordination Office roles and responsibilities; 
establishing REAL ID Program Office personnel to be responsible 
for monthly contact with an assigned representative from each 
state; and taking advantage of FEMA' s existing regional divisions 
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throughout the nation to schedule meetings to discuss grants, 
provide program updates, and answer specific questions. These 
are positive steps toward addressing our recommendation. 

In discussing the criteria for grant awards, the Acting Assistant 
Secretary indicated that our report inaccurately states that DHS 
decided to "distribute grant funds more broadly." We adjusted our 
report to clarify this discussion. As we state in our report, and as 
the Acting Assistant Secretary's own response indicates, DHS did 
"adjust the basis for award allocation to include the peer review 
score and the size of state's DL/ID system." This decision to 
include the size of a state's DL/ID system in the basis for award 
allocation resulted in a broader distribution of grant funds than was 
initially evident to states. 

The Acting Assistant Secretary provided a number of additional 
editorial comments regarding specific sections of the report. We 
worked with the REAL ID program to address each of these 
suggestions and comments and made updates to the draft report 
where appropriate. 

The Acting Assistant Secretary also submitted several substantive 
suggested changes. First, the Acting Assistant Secretary suggested 
that the word "certified" was incorrectly used to describe the 
states' requirement to obtain an extension of the December 31, 
2009 compliance deadline. However, the Final Rule specifically 
states that, "DHS has indentified eighteen milestones, captured in 
the 'Material Compliance Checklist,' that States must certify they 
have met in order to obtain an extension of the compliance 
deadline beyond December 31, 2009." Therefore, we did not 
change the report in this case. 

Secondly, the Acting Assistant Secretary said that, "DHS never 
promised 'guidance' on the costs of verification systems to states." 
This statement does not accurately reflect our report's message. 
We recognize that DHS has been working with organizations such 
as AAMVA and the Verification System Working Group, which 
have responsibility for such guidance. DHS did, however, indicate 
at a forum on the Final Rule in February 2008 that guidance on 
ongoing costs for system access would be forthcoming. Therefore 
we did not change the report in this case. 
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Appendix A 

Scope and Methodology 



We began our audit work by conducting background research to 
gain an understanding of the REAL ID Act of 2005 and DHS' 
responsibilities for implementing REAL ID. We reviewed reports 
prepared by the 9/11 Commission, Government Accountability 
Office, other federal agencies, public interest groups, and 
Congress. We also reviewed the REAL ID Act, records of 
congressional testimony, and meeting minutes. We attended 
REAL ID informational meetings with private sector and public 
sector interest groups such as AAMVA, National Conference of 
State Legislatures, and National Governors Association. 

To obtain information on the current status of REAL ID 
implementation and state cost challenges, we obtained internal 
DHS correspondence that established policies and procedures 
relative to REAL ID from the REAL ID Program Office. We 
looked at the Notice of Proposed Rulemaking, DHS' Regulatory 
Evaluation, and the Final Rule. We also researched the 
department' s internal Web site to obtain relevant information about 
REAL ID regarding DHS' roles and responsibilities for 
implementing REAL ID, progress made toward implementation, 
associated costs, and grants. Owing to the high visibility of the 
REAL ID program, we reviewed DHS press releases and 
researched media articles that pertained to REAL ID. We also 
researched legislation that established individual states' positions 
on compliance with REAL ID implementation. 

To obtain information on grant usage, we reviewed the FY 2008 
REAL ID Demonstration Grant Program document, researched the 
department' s internal Web site to obtain relevant information about 
REAL ID grants, and reviewed DHS press releases and media 
articles that pertained to grants. 

We conducted our audit fieldwork from June to September 2008 at 
REAL ID Program Office headquarters and FEMA GPD in 
Washington, DC. We met with DHS REAL ID Program Office 
officials responsible for REAL ID program management, planning, 
and implementation to obtain information on the progress made 
toward the implementation of REAL ID among all 56 states. We 
also met with officials from FEMA GPD responsible for the REAL 
ID grants management and administration process. 

We selected a sample of 19 states that were a combination of 
border states; states within the interior of the contiguous United 
States; states with large and small populations; states that support 
and oppose REAL ID; states that issued identification to the 
terrorists involved in the September 11, 2001, attacks; states that 
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Appendix A 

Scope and Methodology 



represent each of the U.S. geographic regions: North, South, East, 
and West; grant recipient states; states that applied for REAL ID 
grant programs; and states recommended by REAL ID Program 
Office and FEMA GPD officials. 

We visited the state DMV, Governor's office, and REAL ID 
program and grants representatives in the following states: 

• Richmond, Virginia; 

• Hanover, Maryland; 

• District of Columbia; 

• Jefferson City, Missouri; 

• Olympia, Washington; 

• Sacramento, California; 

• Santa Fe, New Mexico; 

• Austin, Texas; 

• Tallahassee, Florida; 

• Honolulu, Hawaii; 

• Wethersfield, Connecticut; 

• Albany, New York; and 

• Raleigh, North Carolina. 

We also teleconferenced with the state DMV, Governor' s office, 
and REAL ID program and grants representatives at the following 
locations: 

• Springfield, Illinois; 

• Harrisburg, Pennsylvania; 

• Saint Croix, U.S. Virgin Islands; 

• Atlanta, Georgia; 

• Augusta, Maine; and 

• Helena, Montana. 

We conducted this performance audit in accordance with generally 
accepted government auditing standards. Those standards require 
that we plan and perform the audit to obtain sufficient, appropriate 
evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the 
evidence obtained provides a reasonable basis for our findings and 
conclusions based on our audit objectives. 

The principal OIG points of contact for this audit are Frank Deffer, 
Assistant Inspector General for Information Technology Audits, 
and Richard Harsche, Director, Information Management. Major 
OIG contributors to the audit are identified in Appendix C. 
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Management Comments to the Draft Report 



US. Department of Homeland Security 

Washington, DC 20525 



4m Homeland 




IsP Security 



MEMORANDUM FOR; Frank Deffer 

Assistant Inspector General for Information Technology Audits 
U.S. DepartmennjfHomeland Security 



Thank you for the opportunity to review the draft report. Below you will find a joint response 
from the DHS Office of Policy and the Federal Emergency Management Agency (FEMA) 
providing comments on the findings and context for assertions made in the draft report. These 
comments focus, in particular, on cost estimates for implementation and the grant process. Both 
of these items highlighted the importance of communication efforts with state departments of 
motor vehicles (DMV). We concur with the two recommendations made in the report, with the 
minor edits, that we discussed to the first recommendation at the exit conference. 

By way of introduction, secure and reliable state-issued driver's licenses and identification cards 
(DL/ID) form an essential component of the Department's strategy for securing the Homeland, 
preventing terrorism, and combating identity fraud. Recognizing that these documents are the 
most widely used forms of identification in the United States, the Department has worked very 
closely with the states and specifically with state DMVs on ways to improve the integrity and 
security of their DL/IDs. A significant part of our collective efforts has been driven by 
legislative mandate through the implementation of the REAL ID Act. The Act directs DHS to 
set minimum standards for DL/IDs that will be acceptable for official purposes. The law is not 
binding on states, as they can choose to comply or not comply with the minimum standards of 
REAL ID. 

Cost Estimates 

The Department recognizes that the cost of implementing REAL ID, both for the states and the 
federal government, has been a core concern since enactment. As noted in the report, the 
Department focused intensely on reducing the costs, consistent with the mandate. To that end, 
we identified a cost reduction in the final regulation of 73 percent, largely through recognition of 
the challenge of in-person re-enrollment capacity. The Act and the final rule clearly articulate 
the performance standards to be met, leaving the states with as much flexibility as possible 
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regarding how they incorporate requirements into their unique processes. Many of the states 
have already met some of the requirements - such as ensuring the physical security for 
production of a DL/ID and securing the personal data collected in the issuance process - through 
compliance with state laws and industry best practices. 

The report cites three areas cost information is still needed to develop more complete cost 
estimates: card markings, physical security, and verification systems. In addition, the report 
recommended the REAL ID Program Office call together representative stakeholder groups in 
formal and informal ways to provide input as appropriate to address these and other issues. We 
agree. The following briefly outlines our activities and outreach in the three areas. 

With respect to card markings, DHS convened a stakeholder group consisting of state DMVs, 
experts in forensic document analysis, DHS components who will be using the markings in their 
operations, and vendors who would be producing the markings on documents for DMVs. Input 
received from this meeting was incorporated into the design and creation of the final REAL ID 
Compliance Markings, issued on Friday, January 9, 2009. DHS has provided documentation 
demonstrating this effort to your office and is happy to provide any additional information 
determined to be necessary. 

Second, DHS promised to provide guidelines on physical and data security at the request of a 
number of states. The guidelines are in interagency clearance, pursuant to the executive order on 
significant guidance. Again, we pulled stakeholders together to review drafts and provide 
feedback to ensure the guidelines covered the issues of concern to the states. We hope to issue 
the guidelines shortly. 

Lastly, DHS estimated that approximately 40 percent of the costs to states are IT-related and 
some of these costs cannot be fully estimated until the requirements and design of the 
verification hub has been completed - a process managed by the states for the states. The 
verification hub requirement identification effort has been underway for more than a year 
working through the American Association of Motor Vehicles Administration (AAMVA) 
Verification Systems Working Group. A more disciplined verification hub requirement effort 
was launched in October 2008 with the $17 million FY 2008 REAL ID Demonstration Lead 
State Grant award to the State of Mississippi and grants of $1 .2 million each to the three other 
pilot participating states. They are responsible for leading the formal effort to develop 
requirements, system design documents and establish a governance model to sustain the system, 
which necessarily includes a financing model. The states are also responsible for ensuring 
appropriate stakeholder participation. Thus, the states will collectively play a lead role in 
determining the overall costs of IT development, operations and maintenance on individual 
states. 

For the reasons noted above, segregating and fully quantifying the costs specific to 
implementation of REAL ID remains challenging. We continue to encourage the states to 
develop cost estimates and have incorporated reporting regarding progress and cost into the grant 
process, something we expect to refine over time. 
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Grants Process 

Our comments on. the report's treatment of the grant program focus on two areas - the criteria for 
grant award and communication with the states. 

The FY 2006 Appropriation Act required DHS to develop and obtain Congressional approval of 
the REAL ID Implementation Plan prior to awarding grant funds. The REAL ID Implementation 
Plan was approved by Congress in August 2007. In addition, DHS developed and included grant 
award criteria in the 2007 REAL ID Implementation Plan. The award criteria included in the 
2007 REAL ID Implementation Plan was used as the basis for the FY 2008 REAL ID 
Demonstration Grant funding award allocations to the states. The Congressionally approved 
2007 REAL ID Implementation Plan allocated the majority 1 of available funds for competitive 
grants with the following priorities: 

• Initial development of an integrated system for state-to -state data exchange. 

• Improvements to the Electronic Verification of Vital Events hub to support the volume of 
transactions required under REAL ID. 

• System development to support applicant data verification with the Department of State, 

• Model standards and procedures for document verification by state DMVs. 

• Model privacy standards, security practices, and business rules regarding verification of 
driver information with Federal and state agencies, 

• Modifications to, or expansion of, the Commercial Driver License Information System 
(CDLIS) to meet the requirements of the REAL ID Act. 

The REAL ID Implementation Plan also detailed the following criteria for grant awards: 

• Expedite deployment of required verification systems. 

• Expedite states' ability to connect to required verification systems. 

• Involve the joint efforts of multiple states or state DMVs. 

• Reduce the costs of REAL ID implementation for individuals, states, and the Federal 
Government. 

• Reduce the potential for fraudulent use or abuse of DIVIDs. 

• Expedite state progress toward compliance with REAL ID implementation. 

The above criteria and priorities reflect our emphasis on verification capabilities, but at the same 
time are not exclusive to those activities. As such, the report inaccurately states that DHS 
decided to "distribute grant funds more broadly." DHS awarded targeted grants to the lead and 
pilot states to begin development of the verification hub, With respect to the state-specific 
awards, DHS did adjust the basis for award allocation to include the peer review score and the 
size of state's DI7ID system as a measure of the scope of efforts the state will need to undertake 
to become compliant with REAL ID. In addition, DHS extended the deadline for applications 



1 The Commonwealth of Kentucky received 13 million of the original FY06 grant to fund a REAL ID Pilot Project 
to fund birth record verification process improvements. DHS awarded an additional $4 million REAL ID Vital 
Events Verification State Project Grant to Kentucky to fund connectivity to the Electronic Verification of Vital 
Events (EWE) hub by all jurisdictions. 
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based on requests from states to simplify what they considered a difficult application form, We 
believe documentation regarding our outreach has been provided, however, we are happy to 
provide further documentation if needed. 

FEM A/Grants Programs Directorate (FEMA/GPD) worked diligently with prospective grant 
applicants in advance of the application submittal deadlines to ensure that each received grant 
program guidance and was notified of required application edits or changes. Recognizing that 
many state DMV applicants had limited or no experience with the FEMA grant process, 
FEMA/GPD - in conjunction with the REAL ID Program Office - established formal and 
informal lines of communication to assist them in preparing and revising their grant proposal 
submissions. Formally, the REAL ID Program Office and FEMA/GPD convened a special 
question and answer meeting with National Governors Association leadership and numerous 
state department of motor vehicles leaders to ensure DHS provided absolute clarity of program 
goals and grant processing requirements. At the conclusion of the meeting, FEMA/GPD agreed 
to send to all selected state DMV applicants the revised grant language. This revised language 
clarified program goals and grant processing requirements. Informally, states DMV applicants 
were encouraged to call FEMA's toll-free number or the REAL ID Hotline to ask questions or 
request program and grant application assistance. Finally, recognizing that many state DMVs 
were unfamiliar with the grant application process, states were provided, and most states 
accepted, a second opportunity after their initial grant application was submitted to improve the 
quality of their grant application. 

We agree with the recommendation to develop a communications plan. We have already begun 
a joint effort to that end. In addition, we have taken the following steps to ensure outreach on the 
FY09 grants: 

• Developing a memorandum of understanding to articulate our shared commitment and 
clearly delineate FEMA/GPD and Office of Policy/Screening Coordinating Office roles 
and responsibilities 

• Established REAL ID Program Office personnel to be responsible for monthly contact 
with their assigned REAL ID representative from each state 

• On January 22 nd ' conducted the first FEMA regional meeting with Region V states 
{Illinois, Indiana, Michigan, Minnesota, Ohio and Wisconsin) state POCs to discuss FY 
08 and FY09 grants, provide program updates and answer specific questions. This 
regional meeting format worked well and wc are currently working to schedule similar 
meetings with other Regions in the near future 

Additional comments: 

Page 3 

Comment. The requirements of the Act only apply to states that choose to comply and only to the 
issuance of compliant cards, with the exception of 6 CFR 37. 71. The descriptive language on 
page 3 and following should reflect the limited scope of applicability of the Act and rule. 

It is important to note the dedicated funding because the states can use other grant funds to 
support REAL ID implementation in their state at their discretion. 
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States do not need to "certify " that they meet the milestones. All they need to do is Jill out and 
submit the Material Compliance Checklist with the date a benchmark was met or will be met. 

Comment. DHS did have both a strategy and process for developing guidance on card marking 
and physical security. State comments reflect delays in delivering on DHS commitments and not 
the absence of a strategy. DHS drafted proposed guidance documents, actively solicited state 
input and review, and submitted both for agency and interagency review. The card marking 
guidance has been completed and disseminated to states. The guidance on facilities security is 
currently in interagency review. The process may have been delayed but it proceeded as 
planned. Recommend that this statement be modified. 

Page 1 3, first paragraph 

Comment. There is no specific requirement for 125 character storage of the full legal name. 
However, DHS endorses AAMVA current and proposed standards for capture, storage, 
formatting, and transliteration of name data. Recommend that the statement be qualified to 
indicate that the! 25 character standard is an AAMVA standard and not a requirement of the 
DUSrule. 

Comment. REAL ID does not require states to share information with issuing agencies or with 
other states (except for the status of current driver s licenses or REAL IDs valid in other states). 
Data is matched or verified, not exchanged. If an individual is found to have multiple REAL IDs 
or driver 's licenses as a result of the state-to-state query, the state originating the query must 
receive confirmation that the (other) existing license has been terminated, but no additional data 
is exchanged. Recommend change "share" to "verify.. 

Page 1 5, last paragraph, page 1 6 top 

Comment. DHS has never promised "guidance " on the costs of verification systems to states. 
DHS has promised to provide the funding to states so that states themselves could jointly 
determine the basis for these costs. DHS has been working with AAMVA and the states to define 
system requirements for verification systems. Only after states have documented both system 
requirements and detailed design for these systems can cost information in general and 
transaction cost information in particular be identified. 

Page 19. 1st paragraph 

Comment. The press release announcing grant awards correctly stated the award basis - it was 
not "a number of factors " but very clearly the criteria from the, grant guidance and the size of 
the state 's DL/ID system. 

Page 2 1 , Recommendations 

"Recommendation #1 : Establish a stakeholder group" 
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Appendix B 

Management Comments to the Draft Report 



DHS has worked with AAMVA to establish stakeholder "working groups " based on particular 
tasks to ensure appropriate, focused participation. For example, groups have been established 
to define verification system requirements, revise AAMVA card standards, and review proposed 
guidelines for card marking and physical security standards. DHS has refrained from 
establishing a single, comprehensive stakeholder group for all REAL ID implementation issues 
because of the need to bring together the right level of expertise among stakeholders in 
particular areas (i.e., those with verification system ownership are different from those with 
expertise in the levels of physical security features on cards). 

Additionally, state DMVs have requested that we work closely with AAMVA as the entity that 
formally represents their interests and concerns in Washington. To that end, DHS has sought to 
take advantage of the existing communications infrastructure of AAMVA as well as AAMVA 
standards setting, training, and IT systems operations activities. For example, DHS is 
supporting an AAMVA special project to revise the AAMVA International Card Specification to 
include the requirements of the final rule. While DHS is solely responsible for setting REAL ID 
requirements and assessing conformity with those requirements, DHS believes that it should not 
compete with or duplicate the activities of AAMVA, Federal Motor Carrier Safety 
Administration, and other public or private standard setting bodies. 
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Executive Secretary 
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Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs 

Assistant Secretary for Office of Legislative Affairs 
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Director, Screening Coordination Office, Office of Policy 
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ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4199, 
fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig. 



OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 
misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 
Attention: Office of Investigations - Hotline, 
245 Murray Drive, SW, Building 410, 
Washington, DC 20528. 



The OIG seeks to protect the identity of each writer and caller. 



